@strong pumice Get ready for pain
@orchid remnant :D, Good I need a new box to do. I've done almost all of the boot2root boxes
#site-bugs
strong pumice
orchid remnant
This one is horrible
It has nothing on Monkshood
But it is a pain in the rear end
frosty cape
Same here, don't think it's a timezone issue as going to assume we are on the same timezone
@urban flame I've tested it with every hour, and its not bugged out for me. Its hard trying to replicate this bug hm.
urban flame
Yeah, same time stamps as @fresh tide but repeated for me, example above - 14 -> 1 ->2 ->1 -> 2 - edit: I answered 7 questions when this happened
fresh tide
@fresh tide what timezone are you in?
@frosty cape As szymex mentioned it got fixed after sometime. GMT +05:00 (Pakistan)
covert kernel
On CC: Pen Testing ... Task 5 - Section 2 Web Enumeration with Nikto ... Question #7 refers to deprecated flag of Nikto. "-update" no longer works.
orchid remnant
Oh @covert kernel? 😁
covert kernel
The question should be rephrased or maybe removed, IMO
hazy stratus
@covert kernel so here's the thing, it's difficult to remove a task right in the middle of a page without having to re-do all the other tasks atm. It's a limit on the content creators tools side
http://puu.sh/FRsf8/a84ce9d214.png
ATM, only the last question
covert kernel
I understand but it should be fixed
May or may not be easy , true, but the answer is technically wrong
Anyway, I was just pointing it out
vestal carbon
hello I have a bug on room of metasploit I tried all numbers between 0-9 and everything is saying is wrong...
spiral flame
@vestal carbon Not a bug, read the question carefully.
rare swallow
lol
it was spelt as Viet Nam before @covert kernel
so i brought it up and it seems that this is the end result
@frosty cape plz fix my 7 days badge plz and also Vietham is not a country it's Vietnam
frosty cape
Done
hallow hamlet
hey admins, is there any problems with servers ? because it doesn't load tasks in tryhackme.
topaz venture
Try pressing Ctrl + Shift + R in your browser @hallow hamlet (:
hallow hamlet
same @topaz venture
topaz venture
What room is it you're trying specifically? Try with another browser perhaps?
hallow hamlet
learn linux
jade beacon
I've completed all the tasks in Alfred, but it's still showing as incomplete for me.
autumn wave
Brainstorm needs a once over. Several members, to include myself, are having issues with validated exploits crashing the brainstorm.exe service, but not connecting via reverse shell. I attempted to use the exact python script I used in the last month to complete the room, and it has now failed several times. Please see #offensive-pentesting-path for additional conversation on the issue.
hallow apex
this is not exactly a bug, but I have been like 4 days trying to get the flag. https://tryhackme.com/room/introtopython the order of the encodements is not very well explained. It firsts says thatit has been encoded in base16 then base32 and then base64, so decoding should be -> base64 -> base32 -> base16. But nope, it is the same way as the encodig, maybe this could be fixed, or maybe I don't really understood the explanation.
orchid remnant
That order has confused a bunch of people now. Any chance of reversing it in the task @worthy stag?
worthy stag
Sure, part of the challenge is to figure out which way the encoding is but I can remove that aspect
vestal carbon
@spiral flame | James thanks
hot quartz
Just want to point out, that in room BP: Networking there is a mistyped binary number. It should be 11000000 (two ones and six zeros) istead of 1100000 (two ones and five zeros). Because there is written that it means in decimal, 192.168.1.12 but actually it means 96.168.1.12
hot quartz
oh my bad 😄
spiral flame
@orchid remnant can you pop an extra 0 on there?
worthy stag
Walkthrough room blood showing up on releases?
spiral flame
Confirmed, but it was also released in the challenge slot so big ??? there
worthy stag
Yeah was a bit confused as to whether it should be there
spiral flame
@frosty cape what's up with this?
frosty cape
I've removed it from the releases page.
spiral flame
@frosty cape the bug with the hacking heatmap not showing up to date data is still here
It skips days even though they're returned to the API
frosty cape
Let me look now whilst its there
So there are some days in May you say that are not showing, but are in the API?
spiral flame
@frosty cape Nope, the 31st, 1st and 2nd of may/june aren't showing
Chart ends early
frosty cape
Are you sure data is missing?
Checking manually, its showing what the API endpoint is returning
Your profile (05.01) has 25 events inthe API and thats what is shown
Same for the 2nd
Also it wont show 2nd as the day hasn't ended
hallow apex
Sure, part of the challenge is to figure out which way the encoding is but I can remove that aspect
@worthy stag well, you made it with me almost xD
frosty cape
Oh right, it will appear tomorrow/next day
Its how the heatmap is displayed
I dont have much control over that
vocal raptor
Streak bug - "Answer within 24 hours to keep your streak", this makes it sound like if I answer right now I will keep the streak, despite not answering after midnight 🙂 I would hide this message until the next day, so it says "answer in 8 hours to keep your streak"
pseudo rover
Hey, could you please fix this in Fowsniff CTF room? Thanks
olive drum
same ^
median sapphire
@spiral flame You beat me to it, was just about to report that 🙂
spiral flame
frosty cape
@frosty cape https://tryhackme.com/room/injection fonts broke
@spiral flame Try now?
This will be fixed when I move it over to markdown
frosty cape
Mind trying again for task 1?
spiral flame
Ok, so it's overriding the inherited style with just "ubuntu mono" with no fallback
Still nothing
@frosty cape
pine quiver
I’ve been having an issue with Brainpan1 where my exploit just crashes the server and doesn’t open a reverse shell. I’ve looked at every walkthrough and copied their final exploit and same problem. I believe this is a bug with the box, but would be welcome to know if I’m just doing something wrong!
fresh tide
Lost my 6x streak.. Around 8 hours ago it was showing 18 hours but now streak went to 0 while on profile it was still showing 6x streak and after answering a question it went to 1.
olive drum
@vocal raptor
Shodan room, Task 4 Question 5; The current answer is not the top one
PoC: https://www.shodan.io/search?query=asn%3AAS15169+country%3A"US"+city%3A"Los+Angeles"
vocal raptor
oops, yeah the answers change a lot. i cant currently log into THM but i'll fix as soona as i can 🙂
olive drum
nice
fresh tide
Lost my 6x streak.. Around 8 hours ago it was showing 18 hours but now streak went to 0 while on profile it was still showing 6x streak and after answering a question it went to 1.
This ^^^
spiral flame
@fresh tide Skidy is aware they're buggy
fresh tide
i was hoping to get that 7x streak badge today 😦
spiral flame
You wouldn't have recieved it anyway
It doesn't award properly
I have a nearly 2 week streak atm
But it's not tracked
fresh tide
GG
covert kernel
hi
urban flame
You wouldn't have recieved it anyway
@spiral flame the 7 day streak awarded me the badge... badge reward is slightly buggy too
spiral flame
@median dome you around to talk about injection?
spiral flame
@median dome DM?
median dome
Sure
wind wave
same flag twice i guess and it will show 3 flags
spiral flame
Known issue
Discovered by @fresh tide and I
It's been reported, and is hopefully being fixed soon
if you can reproduce it, just abuse it for points
Don't do that
fresh tide
I wonder if you did some dumb thing like i did 😄
But Ninja found the proper way to abuse it
unreal lantern
Is the Steelmountain room broken? (the machine)? Left it half-way through this morning, just re-deployed (twice) and I can't get to ping, connect, anything...
unreal lantern
I truly mean it, I managed to connect today, know how to get in... but now it seems 100% down, not even the webserver is up (:80)
spiral flame
#site-support this will be a VPN issue
ebon oyster
The badge jpg file cannot be added in linkedin profile. It says Sorry, we were unable to blah blah. any workaround?
spiral flame
Linkedin expects a link, you're providing a file. This isn't a THM issue.
covert kernel
there is a typo in the Vulnversity | [Task 4] Compromise the webserver |#3 "Click on "Payloads" and select the "Sniper" attack type." - "Payloads" should be "Positions"
ebon oyster
no I am providing the aws link that is there in the public page.
Same thing I do with my stackoverflow badge.. it works with no problems.
I think this is a thm issue, because when you open the s3 link it automatically gets downloaded. so basically it means it uses application/octet-stream as mime type. Which is not image from a content type perspective. That's why it cannot be added in linkedin as link.
But it should, badges exists to add to some signature or profile or something. Otherwise it doesn't have any use really.
novel carbon
I'm not able to connect to the EU-VIP-1 vpn these last few days! its giving me an error
spiral flame
@novel carbon #site-support
novel carbon
okidoki
spiral flame
Email title when your sub expires said you cancelled it
I didn't cancel it, it just expired
spiral flame
Also I got an email asking me to subscribe. I renewed my sub already
covert kernel
it's just people using emails as usernames
topaz venture
I have deleted it
covert kernel
@covert kernel mind deleting most of it and censoring emails?
@short jackal but it's public
topaz venture
Probably better to disclose things like that through the appropriate means, rather then pasting onto here @covert kernel
short jackal
yeeah
covert kernel
pardon
short jackal
also i wouldn't want my email randomly posted in a channel on discord
topaz venture
File a report with all of that to hello@tryhackme.com @covert kernel. It'll be handled better there. @short jackal pinged skidy so he'll be aware - but it's best placed there
covert kernel
also i wouldn't want my email randomly posted in a channel on discord
@short jackal so i can't even link to profiles ?
topaz venture
That's very different
covert kernel
what i posted was just usernames
short jackal
these were emails that acted as usernames
still, they were emails
covert kernel
so can i link to profliles?
short jackal
yes
covert kernel
delete this too?
topaz venture
Yup
Yikes
Thanks for letting us know
file a report on over to hello@tryhackme.com with it all, but I'm raising it too
topaz venture
All good, It's just all about responsible disclosure 👍
pine quiver
Saw the confirmation of brainstorm, just wanna bump brainpan1 for either a confirmation or disproof
topaz venture
I know brainpan has been flagged, there's discussion about it - I don't know either way I'm afraid (:
When I say discussion, as of a couple of hours ago so...
pine quiver
Got it! Sorry for the spam, thanks for the response!
topaz venture
👍
autumn wave
I'll check Brainpan quick. Brainstorm is filtering the 9999 port and making it unusable, as well as FTP issues.
Brainpan works fine.
topaz venture
Thanks for taking the time to check @autumn wave (: mucho appreciated
pine quiver
Hmmm... when I try it with your walkthrough code it just crashes it for me 😦 @autumn wave
autumn wave
If you want we can walk through it in #offensive-pentesting-path
pine quiver
Can I ping you about it tomorrow?
autumn wave
Sure that'd be ok.
pine quiver
Great, thanks! 🙂
autumn wave
You're welcome.
manic ice
execuse me,i need answer in room CC: pen testing task 7# What option sets the architecture to be exploited?
cinder crow
Wrong channel #room-hints
atomic agate
https://tryhackme.com/room/webappsec101 These links are broken ---> https://www.owasp.org/index.php/Forced_browsing , https://www.owasp.org/index.php/Path_Traversal
ebon oyster
it works right? i can open it. it automatically 302s to another path.
spiral saddle
hi i have a question
my kali machine keeps asking for username and password
it is not my login and password
atomic agate
it works right? i can open it. it automatically 302s to another path.
@ebon oyster weird, doesnt work when I click on the link in the room
spiral saddle
i just dont know how to fix it
outer copper
I'm having the same issue
ebon oyster
@spiral saddle u can get the username password in https://tryhackme.com/room/kali room
outer copper
@spiral saddle I was able to ssh to it but not use the in browser version
spiral saddle
@outer copper i was trying to use the in browser version but they are giving me this error
void plaza
On hackpark I keep getting detected even with -Pn
covert kernel
i think i went unnoticed: there is a typo in the Vulnversity | [Task 4] Compromise the webserver |#3 "Click on "Payloads" and select the "Sniper" attack type." - "Payloads" should be "Positions"
gilded scroll
Doing the Dumping Router Firmware room, and when look at the builddate, it seems to changed from when the room was done. When i cat builddate i get || 2020-04-22 11:44 || but correct answer is || 2018-05-01 18:10 ||, Same with version, i get || 2.0.3.201002 || when correct is || 2.0.2.188405 ||
median sapphire
Someone already reported this if I remember correctly.
gilded scroll
Oki.
Didn't find anything except something about firmware not available on Linksys but had to get it from the github
manic ice
execuse me,i need answer in room CC: pen testing task 7# What option sets the architecture to be exploited?.Please help me
median sapphire
@manic ice We don't provide answers.
rare swallow
my streak broke once more
even though i answered a question last night
it should be 15 including today
fresh tide
I lost my 7x 2 days ago as well ^ 😦
median sapphire
I lost my streak as well, but I managed to get the 7day badge
manic ice
then help me if you know that channel ,i stuck on that question.Thanks you so much.
median sapphire
@manic ice #room-help or #room-hints
vocal raptor
@vocal raptor
Shodan room, Task 4 Question 5; The current answer is not the top one
PoC: https://www.shodan.io/search?query=asn%3AAS15169+country%3A"US"+city%3A"Los+Angeles"
@olive drum The answer hasn't changed, since the answer in this query == the answer in the task 🙂
However, linux 3.x is only 1 server away from being at the top so I suspect it might change over sometimes
I'll change it to "Linux 3.x" and have the hint as "top linux"
vocal raptor
it's a nightmare room for maintenance, everything changes all the time 😦
olive drum
yeah I know 😄
manic ice
@median sapphire thanks you XD
vocal raptor
@short jackal maybe i can use your API wrapper to automatically update the room
covert kernel
I'll change it to "Linux 3.x" and have the hint as "top linux"
@vocal raptor also the top country question was broken
vocal raptor
Iirc the top country had 38k servers and the 2nd top had 6k last time I checked
What is it now?
covert kernel
when i did it the correct answer was ||EU|| but shodan said HK
spiral flame
Don't do that.
rare swallow
Room:
https://tryhackme.com/room/eritsecurusi
first command to get the shelll doesn't match the wget command.
They should both match either as cmd.php or c.php
rare swallow
nc not ncat
median sapphire
I mean technically it would still work, since ncat is a real thing(from the nmap project) 🤷♂️
rare swallow
other PORT *
hard horizon
still shows completed rooms
spiral flame
@hard horizon Wait for the rooms to load otherwise it breaks the filters
Known issue
hard horizon
@spiral flame Thanks
raw nacelle
there is a bug on my window right now
spiral flame
@raw nacelle No. This channel is for TryHackMe bugs.
covert kernel
can somebody run a quick zap scan against the machine in RP: Web Scanning. i dont get anny results for xss. is it me or is there a bug. thx in advance
spiral flame
@covert kernel known issue.
covert kernel
ok so i have to look the answer up in aa writeup ?
spiral flame
They shouldn't include answers
jaunty coyote
Corp box: when you crack the AS-REP hash and get a password, I feel like that user whose password you cracked was not intended to have local administrator / domain admin, as the next step is supposed to be privilege escalation using PowerUp.ps1 and a panther unattended.xml
cinder crow
Those are two very different things which is it a local or domain admin and just because you crack an as rep hash doesn’t mean they’re a domain admin
hazy stratus
^
jaunty coyote
Obviously not. So, I kerberoasted and got a hash of a user. Crack the password. The next step looks like they want me to privesc to administrator for the root flag. But, as that user, I can just go get the root flag. I did whoami /priv and I'm local admin and domain admin, I feel like that is in error
otherwise whats the point of running a priv esc on an admin account, you are already escalated... the privesc is unnecessary, they could just submit the root.txt flag..
cinder crow
you’re mixing up a lot of terms and I’m a little confused now what room is this?
sorry didn’t read
what user did you get from Kerberoast
jaunty coyote
Corp\fela
then it instructs me to use powerup.ps1 and find a panther unattended XML to base64 decode the admin password. But when I logged in as fela, I already have access to get the root flag as I am a local admin and domain admin, I figured it wasn't supposed to be that way
cinder crow
I just checked the room it’s intended
you’re supposed to be have access to that flag for fela but there is another flag for another user that you wouldn’t even be able to see unless you priv esc to that other user
jaunty coyote
well it worked for me, I turned in the administrator flag by base64 decoding the panther unattended.xml file, but that was not needed to read the root flag, i guess it doesn't matter... but usually the reason you want to Escalate privileges is because you don't have them already
so if you have full privileges, there is no priv esc needed
cinder crow
I think I know the issue it is a bug but it shouldve been fixed @covert kernel the bug where you can read the administrator flag from the fela desktop I thought you fixed it
cinder crow
what what when I was reading the write up they said they talked to you about the bug
covert kernel
Huh?
cinder crow
covert kernel
They may have talked to me about it but what am I supposed to do about it?
The box creator would have to upload a new ova fixing the bug
cinder crow
I thought it might have been yours whos is it then?
covert kernel
I have no idea
cinder crow
well then 🤷♂️
cinder crow
copy
@stone flint when you have a moment can you please either dm me or message me in the creators lounge about corp admin flag bug
dire ferry
Seems to be a bug with
"Attacktive Directory" When trying to brute force the username with kerbrute for task 4 question #2 the answer does not appear in the names that show up.
cinder crow
you mean you got the answer right and its just not on that list or youre assuming because you havent been able to find the answer its not there?
dire ferry
yes..I got the correct answer.. although by the method it is asking.. the answer is not showing.
kerbrute is not showing the correct answer
cinder crow
did you use the provided wordlist?
dire ferry
yessum. I even created a wordlist with just the correct answer and it still did not provide the correct answer.
I was thinking it could be the version of kerbrute but.. it shows the other names..
dire ferry
so the worldlist that was provided shows other vaild usernames just not the answer that its asking for.
cinder crow
thats odd I dont think that he changed it all recently so it might have just not booted with that user for some odd reason a terminate and redeploy will probably help
dire ferry
yessum.. I have done that 3 times... Let me log off and back on.
cinder crow
let me spin up the machine real quick
dire ferry
I can send a screen shot if needed
cinder crow
just ran it it is in there not sure why its not working for you
if you could that would be helpful
dire ferry
would you like me to post it in this chat?
cinder crow
Sure
dire ferry
I blocked the answer but its there... in the fill being used.
I tried sorting the list and a few other things... same issue
cinder crow
hmm not sure because it worked for me and you said you redeployed 3 times @hazy stratus any ideas why this is happening?
cinder crow
This is odd I mean as long as you got the right answer 🤷♂️ I’ve never seen that happen before though
he did that
hazy stratus
same
I wonder if latest version of Kerbrute borks it?
you could try svc\-admin and see if that works
dire ferry
trying that now
hazy stratus
svc-admin
svc\-admin
"svc\-admin"
"svc-admin"
there's a couple things you could try
hazy stratus
1 sec
lemme pull the writeup and cross check kerbrute versions
try this version
also, by chance did you happen to build from source?
dire ferry
I used the version provided in the link and used kerbute_linux_386
the link in the room
hazy stratus
should be kerbrute_linux_amd64
dire ferry
let me try that
hazy stratus
i386 is for 32-bit processors, i don't anticipate it having issues but you never know..
dire ferry
no sir same issue let me try an older version
gosh darnnit haha still doesnt work with the v1.0.2 kerbute amd64 version
hazy stratus
that's weird to say the least -- ill do some testing tomorrow morning
dire ferry
thank you.. fyi kali linux 2020 virtual box
fresh lynx
BUG: Clicking KOTH join links AFTER the game has ended still adds you to the game, with no possbility of scoring for it. Suggest join links re-direct to the public page, with a banner that the game has now ended.
short jackal
already submitted, should be fixed soon™
fresh lynx
(Annoyingly, it wrecked my stats!!) 😄
fresh tide
(Annoyingly, it wrecked my stats!!) 😄
@fresh lynx Well there are no stats for koth except for those 5 games showing up.. (unless you are saving GameId's like me.)
fresh lynx
Yeah, just personal record - not public
short jackal
time to scrape all koth games and grab the results to make an unofficial scoreboard on hacks.computer
median sapphire
@short jackal Is that a domain you own? 👀
short jackal
yeah
rn i only have a koth overlay there with stolen borrowed assets from thm
the css broke tho, i need to tweak that
fresh lynx
@short jackal Are you screen scraping or using part of the api?
median sapphire
rn i only have a koth overlay there with
stolenborrowed assets from thm
@short jackal ~~I stole my profile picture from THM ~~ 😇
short jackal
@short jackal ~~I stole my profile picture from THM ~~ 😇
@median sapphire ik
@short jackal Are you screen scraping or using part of the api?
@fresh lynx API, i made a wrapper
fresh lynx
Pls share 🙂
fresh lynx
Funnily enough, I asked 5 mins ago in general for api docs 🙂
short jackal
only few routes are documented on the docs page and they're an external API for deploying
this is all achieved from my hours of scraping+saving routes
fresh lynx
That is annoying!
short jackal
tbh it was fun to deobfuscate the js scripts on most pages and grab routes from that
fresh lynx
Yeah.. Sorry, can you point me to where it is? Not seeing it in scrollback
short jackal
short jackal
:)
rocky wind
How can I Exit from a non free room?
I did not subscribe but I have Linux challenges in 'my rooms'!
hard horizon
How can I Exit from a non free room?
I did not subscribe but I have Linux challenges in 'my rooms'!
@rocky wind yeah me too
spiral flame
@frosty cape Site's really slow answering questions...
frosty cape
Thats not normal - its also over http and not https?
simple laurel
same
was trying to get the error msg by burp (due to it reload faster than eye could see)
here what it look like at my access kali machine
frosty cape
Would you please mind terminating and redeploying the machine?
simple laurel
well i did several time
still same issues
there are error.. but i couldnot capture it
frosty cape
Let me take a look into it, whats your THM username?
simple laurel
radicz
frosty cape
Okay great, so now please terminate all running instances you have running.
Wait a few seconds
Then re-deploy
molten path
on https://tryhackme.com/room/zthobscurewebvulns - there is a spelling error. "JTW" at the top and JWT a little lower on the page.
urban flame
Pretty sure my streak increased by 2 today
orchid remnant
It shouldn't be?
sly raft
try now?
round cave
Sweet, working now. Thanks
orchid remnant
@sly raft Entropy has a different difficulty between the room page and the releases page -- which is it meant to be? 🙂
covert kernel
also..
round cave
Think that’s part of the lab 😊
orchid remnant
No, it's just borked
round cave
Ha really
finite fern
@covert kernel what software are you using to rdp?
rare swallow
that's remmina
finite fern
thanks, I was gonna use rdesktop but i'll install remmina
topaz venture
remmina is really good
rare swallow
the current room is borky
finite fern
yeah I couldn't rdp using creds either
sly raft
xfreerdp is better than all 😉
round cave
mstsc 👍
autumn wave
I ❤️ Xfree @sly raft
median sapphire
@orchid remnant Entropy still shows as private for me, by the way why is there no announcement for new room release?
small kestrel
Room https://tryhackme.com/room/rppsempire Task 5 Question 8: is wrong. the answer format shows three slashes and the answer that the question expects is not what my console reads. Answer starts with python/** but console reads powershell/*
spiral flame
???
simple laurel
spiral flame
@frosty cape when you wake up
simple laurel
these what it look like
ah.. its browser problem
last time it work on brave... but somehow it doesnot
spiral flame
Skidy uses brave iirc so he'll probably be interested
covert kernel
Not important but in the general tab for managing a room, "were" should be "where" in publicly accessible
median sapphire
@small kestrel Empire was updated afterwards and the answer changed.
topaz venture
Expanding on @covert kernel’s submission
covert kernel
@topaz venture that's great. I still have some stuff to add. Not much of a programming thing without the programming...
covert kernel
Oh haha. That's even better!
topaz venture
Look forward to seeing your room in the queue!
covert kernel
Definitely
Though, I was contemplating on asking you for a bit of advice with the programming section
fresh tide
Pickle Rick Write up in hackback2019:
https://tryhackme.com/room/hackback2019
median sapphire
@fresh tide Yeah, hackback2019 is a collection of rooms
short jackal
pickle rick is one of the challenges there
median sapphire
I see you updated your roles 🙂
fresh tide
aah just people like getting answers from 0xD instead of a 0x9 soo 😄
topaz venture
Imagine being a mod
That assumes that I’m right
People just take my word it’s great
fresh tide
in hackback2019:
https://tryhackme.com/room/hackback2019
Task4 Q#5 First Flag is not being accepted while the same flag is accepted is JuassicPark room
median sapphire
I've already reported that one 😁
median sapphire
@distant sage Not a bug, the room is designed this way.
distant sage
I know it isn't, but why
median sapphire
The room was designed this way, if you know it's not a bug, then don't post it in #site-bugs.
distant sage
ok
olive drum
Juice Shop room
olive drum
nice!
real fern
covert kernel
it is a bug guys? Box Learn Linux
cat: /etc/shiba/shiba3: Permission denied
if i run ./shiba2
spiral flame
@covert kernel not a bug. You broke it.
buoyant dagger
Hi, I'm doing ICE box today but it seems that the box is not giving me the proper privilege when I do getpriv in my shell. What should I do? Tried all the privs given to answer the ICE box questions but it's all wrong. Thanks.
spiral flame
#room-help @buoyant dagger
buoyant dagger
Oh. Thanks! @spiral flame Sorry.
rare swallow
did Thanos snap his fingers on my points :c
buoyant dagger
is this normal?
orchid remnant
is this normal?
@buoyant dagger Which room?
buoyant dagger
@buoyant dagger Which room?
@orchid remnant from Fowsniff CTF
orchid remnant
*sigh* Naturally
buoyant dagger
Thanks
orchid remnant
Check it now @buoyant dagger?
Oh Goddamnit Skidy and your xss filters
Not that they aren't our fault, granted
But still
Hehe, I did one better 😁
Who knew that worked in hints
buoyant dagger
orchid remnant
Refresh and try now?
buoyant dagger
It's fixed. Thank you.
celest edge
in the XSS room, Task 5 Q2, the onhover event doesn't exist...
spiral flame
I mean it's an attribute iirc?
celest edge
it should be onmouseover
spiral flame
Oh hover is a css psuedoclass
celest edge
yeah
hence why I'm posting in bugs 🙂
also the code for the keylogger seems to crash the server...
ebon oyster
one very weird bug I got is that the browser timeout doesn't match the actual timeout.
even if it says 10min in browser it doesn't mean that 10min is remaining.
orchid remnant
@spiral flame if that XSS filter gets removed we're just gonna break it again 🤣
Not that I disagree
spiral flame
@orchid remnant another bottle of whiskey? Let's go
orchid remnant
You're on 😁
fleet iron
Not sure if this is the right place, but for "Network Services" room > Task 9 > Question 1 asks how many ports are open on the target machine. The accepted answer is 1, but I am seeing 2 ports open from my nmap scan.
covert kernel
Does it specify a port range? If not, then I'd say this is the place
fleet iron
It does not.
"Run an nmap scan of your choice.
How many ports are open on the target machine?"
covert kernel
Did you happen to do -p-?
fleet iron
I did not.
covert kernel
Hmm
fleet iron
I'm very new to all of this. I did nmap -v -A
covert kernel
We all begin somewhere
fleet iron
It's been a blast so far. Just for more information its showing 21 and 80 open on my scan. I only knew it was 1 because the following question is worded "What port is this?".
buoyant dagger
found this at google dorking room
topaz venture
Thanks @buoyant dagger I’ll fix it shortly (:
buoyant dagger
Thanks @buoyant dagger I’ll fix it shortly (:
@topaz venture Thank you.
bronze shard
Hi Gentelemen,
The b64.txt downloadable file in Task1 in room : Scripting is empty
has anyone looked into it ?
vocal raptor
are you sure it's not extremely large and you can't open it?
because i cant open it in a GUI as the file is too large
I just checked, I can confirm that b64.txt from room Scripting is not empty 🙂
glossy oxide
Is it possible that Christmas XXS machine's automation does not work properly: admin's authid did not pop up in my logs after 2h of trying harder (restarted the machine multiple times and used different XXS payloads, checked the example from @orchid remnant 's write-up)
glossy oxide
I've tried both netcat and nginx's access.log before posting, will re-try again. Thanks
inner sapphire
There is a issue on the reverse elf files challenge
spiral flame
@frosty cape My streak cleared, but heatmap still shows it as being fine
frosty cape
Did you answer a question? Because the heatmap shows events if you have: downloaded a file or deployed a machine
Streaks need questions answered to have them remain
spiral flame
@frosty cape Why the disparity? Doesn't make sense to me
frosty cape
Otherwise people would automate: Logging in and deploy machine, then leaving
At least with answering a question (even if its 1 a day) it requires a little more thinking.
The idea of streaks isn't to prove you're active on the platform a loads (a users heatmap shows that) but to build up a 'Learning streak' ("Learn something new everyday").
daring crescent
hi i found bug
the badges stay on the top layer if I turn on the saddle notifications
median sapphire
Why are you using Windows 7? 👀
pine quiver
Windows 7 OG
daring crescent
windows 7 ❤️
olive drum
eternal blue anyone 👀
median sapphire
@pine quiver Swafox is not asking how to exploit eternal blue, they are a 0xD God, they said eternal blue because Windows 7 by default is vulnerable to ms17_010, and Hooper is using windows 7. 🙂
olive drum
Swafox is not asking how to exploit eternal blue, they are a 0xD God, they said eternal blue because Windows 7 by default is vulnerable to ms17_010, and Hooper is using windows 7. 🙂
@median sapphire exactly! good explanation 😄
median sapphire
covert kernel
Not really a bug but more likely a misconfiguration of the box? in the room 'Introduction to Django', the usr we have access to 'django-admin' can read the user.txt in another home folder but also run any command as root. It's not a big deal but it does make the hint in the user page on admin panel with the hash a bit redundant. Just a heads up @olive drum . Great box otherwise. Learned a lot!
median sapphire
That's intentional, I think, I escalated to root as well.
covert kernel
@median sapphire maybe intentional but by going through the trouble of hosting a hash on pastebin for that other user's password I thought it may have been a mistake too.
olive drum
@covert kernel thanks for the feedback! root was given on purpose because the point here was to test your understanding of basic things like settings, command manager and so on. The hash was put as a 'hint' for those who didn't check the other user's folders beforehand
and also, not everyone checks if they have sudo privileges right away 😄
covert kernel
@olive drum, can I DM you? I had the feeling there was another hidden flag but would like your confirmation
olive drum
sure
short jackal
it should be added automatically, @frosty cape could you take a look when you have time?
frosty cape
@thorn viper Yeah its automatically added - whats your TryHackMe username?
Here please:)
steep wraith
hey, I think there is a bug on the machine available to learn Linux
frosty cape
DeadShot22
@thorn viper I found the bug that stopped you getting the badge and fixed it. I also gave you your 7-day-streak badge:)
orchid remnant
@steep wraith What's the bug?
steep wraith
"The actual binary will check for two things, it will be checking that there's a directory called test in your home directory, how you create that is up to you. It will also be checking that inside the directory there's a file called test1234."
but they are already created
steep wraith
ok thx 🙂
elder olive
Not really a bug but every time I deploy a room and try to copy the machine's IP there is an additional space that is prefixed to the IP. Can anything be done about that?
elder olive
Thats what I do
median sapphire
@elder olive It's already been reported before.
elder olive
Has it already been mended?
@elder olive It's already been reported before.
@median sapphire Oh wow nice
Thanks
celest edge
Not so much a bug as some display awkwardness, but on mobile, the 2 hamburgers are probably a touch confusing
hazy stratus
unfortunately I'm on my phone very often.. its not an enjoyable experience lol
fresh tide
if you are using chrome there is an option to run as a Desktop site.
elder olive
Not really a bug but every time I deploy a room and try to copy the machine's IP there is an additional space that is prefixed to the IP. Can anything be done about that?
@elder olive This thing is still happening
spiral flame
@elder olive do you expect things to be fixed instantly?
elder olive
@elder olive It's already been reported before.
@median sapphire
I assumed this was long ago
My bad @spiral flame
covert kernel
Hello, I am currently on "xss" box, I have successfully popup alert, but the key is not shown
On task 8, challenge 2
Input value <IMG SRC="/" onerror='alert("Hello");'>
Did I do something wrong?
spiral flame
It's a known issue
spiral flame
covert kernel
Ah, alright 👍
worldly pagoda
why i should add my Credit Card every mount ? my card is on file but every mouth i should add it
worldly pagoda
i added my card , but its not auto renew
i receive email cancel subscription and should add my card again
spiral spire
I think there is a bug in Powershell room, I found the answer for Task 3 Question 3, same answer in the walkthrough but I cannot validate the answer...
?
pine quiver
Show pic
spiral spire
Discord fails to upload my printscreen... I tried 3 times
Wait I'll try another way
Nope.. It fails
See? @pine quiver
pine quiver
Ya that answers just wrong @spiral spire
spiral spire
Anyone can create and upload walkthrough without any validation?
spiral flame
Writeups shouldn't include answers at all
Not every room creator verifies every single part of a writeup
steep wraith
another bug find
steep wraith
Nmap can't detect the os
spiral flame
Yes it can
The question is asking for the distro anyway
But it literally says linux in the fingerprint
steep wraith
sry im new i delete ^^
sacred matrix
@versed yarrow did you get the flag? im stuck at xss room ->filter evasion -> challenge 2 too
celest edge
check the attached resources, there's a few hints for challenge 2
Is there a memory leak or some other allocation bug in the hackernote room? every subsequent login attempt with a valid user seems to take more and more time
spiral flame
I tested it as a non subscriber and it works fine
I haven't changed anything
@celest edge I've thrown a hell of a lot at that box, and it was fine
spiral flame
That's really really weird
Because it's normally like under 2 seconds
Terminate and redeploy
celest edge
yeah it's fine for the first 8 or so login attempts with a correct user
the password check takes longer and longer...
let me log some timing with my script
❯ ./password-checker.py 10.10.117.80 wordlist.txt ***** 1
POSTING http://10.10.117.80/api/user/login with *****:amber0
Response time: 0:00:01.525370
POSTING http://10.10.117.80/api/user/login with *****:amber1
Response time: 0:00:01.512899
POSTING http://10.10.117.80/api/user/login with *****:amber2
Response time: 0:00:01.515757
POSTING http://10.10.117.80/api/user/login with *****:amber3
Response time: 0:00:01.511456
POSTING http://10.10.117.80/api/user/login with *****:amber4
Response time: 0:00:01.527331
POSTING http://10.10.117.80/api/user/login with *****:amber5
Response time: 0:00:02.295157
POSTING http://10.10.117.80/api/user/login with *****:amber6
Response time: 0:00:04.751897
POSTING http://10.10.117.80/api/user/login with *****:amber7
Response time: 0:00:07.646025
POSTING http://10.10.117.80/api/user/login with *****:amber8
Response time: 0:00:15.311110
POSTING http://10.10.117.80/api/user/login with *****:amber9
Response time: 0:00:15.198678
POSTING http://10.10.117.80/api/user/login with *****:beige0
Response time: 0:00:17.720299
caps to about 15 seconds
and I'm not even hammering very hard
if I punch at it a bit harder it just gives up
spiral flame
That's really weird
Considering it works fine for me and everyone else
I'm not saying it's your script
celest edge
I'm just poking at it with python and requests
spiral flame
But it looks like the time difference is the time it takes to verify a password
celest edge
couldn't get hydra working, so I adapted the login username checker script
spiral flame
I haven't seen this before
So, terminate and redeploy. I'm not saying it's user error, I'm just saying no one else has had this issue
celest edge
it's terrible, I'm sorry in advance
spiral flame
@frosty cape Did you push the private room points fix yet?
elfin wing
Hackpark is only available for 1 hour....so so annoying and frustrating. Even when you try to extend the webserver stops responding.
anyelse had the same issue?
spiral flame
@elfin wing Known issue.
You need to speedrun the box
You can exploit it very quickly, creds etc don't change
frosty cape
@frosty cape Did you push the private room points fix yet?
@spiral flame Yeah, private rooms don't give you points (on your main account score)
spiral flame
There's still people on the leaderboard that exploited it massively
frosty cape
A point recalculation is coming 3-4 weeks time
frosty cape
When you make changes like this, they need to be retroactive
@spiral flame What do you mean?
spiral flame
That person has completed 25 rooms
12 public rooms
And has an insane amount of points
median sapphire
He's also a 0xD God
frosty cape
And has an insane amount of points
@spiral flame I debunked his points for now.
spiral flame
There is something broken there.
frosty cape
But as I said, 3-4 weeks time everyones points will be recalculated using only public rooms.
median sapphire
@spiral flame The search works for me 🤔
median sapphire
Oops, sorry for that
orchid remnant
Any particular reason we're pushing the deprecated version of Python?..
spiral flame
@frosty cape python3 -m http.server 1234
frosty cape
Any particular reason we're pushing the deprecated version of Python?..
@orchid remnant Nice spot, thanks:)
hazy stratus
py2 best python @orchid remnant
orchid remnant
py2 best python @orchid remnant
@hazy stratus I mean, I used to think that too. Then I figured the world was leaving me behind...
jaunty coyote
I guess it's probably time to stop using Borland Turbo Pascal 7.0 then
oof, im old
wanton copper
hey all, just a heads up trying to do the Introduction to OWASP ZAP and the VM keeps crashing due to load from ZAP but im just following the tutorial
might want to up its power for others
vocal raptor
Any particular reason we're pushing the deprecated version of Python?..
@orchid remnant python3 is the only python on my system, so python == python3. get with the times, nerds
orchid remnant
I should hope so too!
quaint pier
hi, tryhackme rooms(any rooms) are not showing the images, anyone know how to fix?
spiral flame
They're normally served from imgur. If they're not displaying, it's on your end
quaint pier
pffs, always like that :/
rare swallow
check your dns
some ISP block imgur lol
try going to https://imgur.com/ @quaint pier
please read the rules @quaint pier especially rule 1
rare swallow
it's a problem on your side, check with a different browser
quaint pier
different browser same thing
spiral flame
Sounds like it's being blocked by your ISP. Out of our control. I recommend you try different DNS servers etc, but this isn't a tryhackme issue
quaint pier
its fixed ty
jagged garden
hey i have a weird bug on Common Linux Privesc, task 4, #6. The answer I put it returns "Uh Oh undefined"
light jolt
there are two burpsuite rooms that give you the "Burp'ed" badge; Learn Burp Suite && RP: Burp Suite
light jolt
i figured, so if I complete the new one before the old is removed, will I have two Burped badges?? 😛
rare swallow
go ahead and use powershell***
orchid remnant
Which room @rare swallow?
rare swallow
fixed @orchid remnant
orchid remnant
Huh? Who fixed it?
rare swallow
no, i mean i added the url
light jolt
lmao'
light jolt
i believe this should be 'Start Live Capture' #10/#4 RP Burp Suite
spiral flame
@rugged ermine
orchid remnant
@rugged ermine -- I assume you'd prefer to keep RP to yourself 🙂
rugged ermine
Yeah I'll fix that in a sec haha
frosty cape
Speaking of, @frosty cape Path replacements etc?
@spiral flame Its already been replaced? Wasn't me, must have been Ashu or Dark:)
light jolt
i figured, so if I complete the new one before the old is removed, will I have two Burped badges?? 😛
@light jolt can confirm that you do not get another badge D:
proven frost
there is a problem with the RP: Web Scanning room, I am not sure if I have done something wrong while using zap but it does not display the answer for question number 8 from task 3, I had to research the answer for it and indeed it is not showing for me, could you have a look into it because I am pretty sure I have done all steps right, thank you !!
spiral flame
If it's the xss thing, known issue and it's being investigated @proven frost
proven frost
yes it is thank you !!
ornate moss
ornate moss
The Question #x is off center :(
urban flame
Peak Hill - I tried to head the ||pyc|| file and it seems to have encoded the terminal, here is the output of an ls -la. Can be fixed with reset. Not sure if that's a bug with the python file but interesting anyway.
olive drum
i think you broke something yourself
rare swallow
you borked the borked bork
lyric crown
room/jokerctf dumb "lsd" is crashing
rugged ermine
I'm not sure where the issue is there @covert kernel
rugged ermine
ooooh go catch
covert kernel
👍
rugged ermine
Fixed, thank you for posting that :D
wanton copper
Got an issue with Authentication box from the Web Fundamentals path, I'm upto the JWT bit and following the tutorial but the box isnt returning a JWT token like expected? I've stopped and restart the box and it made no difference?
I can change it to undefined if i dont put any usernames in
sullen vessel
You are rewarded a badge and random security gift, if you come 1st place at the end of the month!
I got no badge and no gift, maybe the message should be changed? 👀
spiral flame
@frosty cape
median sapphire
The docs need to be updated 🤔
topaz venture
I will submit a PR updating the docs tonight @covert kernel thank you for letting us/me know (:
covert kernel
welcome. just doing my part (because lord knows i can't write a machine so i may as well find other ways to contribute)
may want ot update it all.. there is no "readies" function additionally... says that a lobby is 6 users.
topaz venture
Hehe for sure! Although that ain't to discourage you from developing rooms! I/we appreciate you recognising issues like this in other sections of the site (:
frosty cape
I got no badge and no gift, maybe the message should be changed? 👀
@sullen vessel Yo flan, DM me, lets get that sorted:)
covert kernel
should i just compile a large list of spelling errors and send them out in 1 shot? is that the easiest method to get these submitted?
median sapphire
Sure?
mint hill
Intro to x86-64 has a correct password collision for the crackme2 binary
covert kernel
Shodan.io [Task 4] Google & Filtering #2 What is the 3rd most popular country for MYSQL servers in Google's ASN?
2 top country
?
cinder crow
I really don’t know why this still hasn’t been fixed but it’s known @covert kernel
orchid remnant
@vocal raptor?
vocal raptor
I really don’t know why this still hasn’t been fixed but it’s known @covert kernel
@cinder crow Wasn't known to me, but it's fixed now. Shodan updates all the time, I can't keep up 😓
cinder crow
its been like that for at least a month
covert kernel
@covert kernel fixed
@cinder crow Thank you
❤️
Shodan.io [Task 4] Google & Filtering
#4 Under Google's ASN, what is the most popular city?
vocal raptor
1 sec
None of those are cities
so its not a bug
🙂
Shodan.io [Task 4] Google & Filtering
#4 Under Google's ASN, what is the most popular city?
@covert kernel Sorry I meant, none of those in the screenshot you sent are cities, so it's not a bug 🙂
I have just confirmed that the answer for task 4 question 4 is right, just in case 🙂
covert kernel
is this the right area to ask for assistance?
cinder crow
no, if you need help on a room #room-help if you need help with vpn #site-support @covert kernel
wanton copper
Got an issue with Authentication box from the Web Fundamentals path, I'm upto the JWT bit and following the tutorial but the box isnt returning a JWT token like expected? I've stopped and restart the box and it made no difference?
@wanton copper any1???
rare swallow
make sure your encoding is NONE
@wanton copper
oh gotcha. so you need to type in both boxes
you can either use burp to intercept
or just use your normal browser and check your cookies, a jwt token should be in there
wanton copper
@rare swallow thanks, I did try both boxes, was using burp but not sure what the encoding setting was will check again tomoz
regal robin
Could not make SMBv1 connection ???how get this work
spiral flame
@regal robin #room-help this isn't a bug
regal robin
im sorry can you guys guide me to this
spiral flame
@regal robin #room-help
regal robin
👍
rare swallow
@olive drum i think there is some text inside the help menu
olive drum
yeah
winged jackal
I think that should be task > Hacking with Powershell
runic trench
Apologies if this is a known bug, but completing the "Complete Beginner" path to 100% does not complete the room
I clicked through all sections of the 21 subrooms to ensure every task was completed
spiral flame
Weird
runic trench
spiral flame
@frosty cape is this expected behaviour?
runic trench
The Burp Suite room was modified/changed after my first completion, but before I completed the entire path, so I went back and re-did it, then finished off the rest of the path
Maybe start there with the troubleshooting, probably not a situation that happens often in regards to timing etc
Leaving/Rejoining path doesn't seem to work
frosty cape
Leaving/Rejoining path doesn't seem to work
@runic trench @spiral flame What do you mean sorry? Its showing 100% because you've completed every room. You wont get a tick on the pathway. It just means you've completed every room available.
spiral flame
Maybe this needs to be made more clear then
frosty cape
Im not sure how much clearer it needs to be? Its a pathway with rooms to be completed:) The only thing left to add is a certificate of completion
I can add a "Pathway Complete" at 100% perhaps
median sapphire
While you are at it, please fix: 😁 #site-bugs message
frosty cape
While you are at it, please fix: 😁 #site-bugs message
@median sapphire Can you explain what happened here? Did you complete every question in the room and it not give you the tick? Also what date did you complete the room.
median sapphire
Yeah, I completed every question in the room, and it's not showing up as completed in hacktivites, not sure about the date through
Not really that much of a major bug
runic trench
The path says "39 hours, 21 rooms, 1 badges" however I have received 4 badges from the rooms within this path, so either it's not pulling badges from the contained rooms (would be 4 if this portion worked) or users are led to believe that "1 badges" are granted upon completion of the path. More clarification is needed, searching the forums shows another user with the same issue.
frosty cape
Ah okay, yeah the badges need updating - let me me get on that.
Thanks for reporting
worn light
I have no idea if this is a bug, or feedback, but: In "RP: Burp Suite" task 7.3 the question is: "Clicking 'Add to scope' will trigger a pop-up. What will Burp stop sending to the history following clicking 'Yes' on this?" Which implies that you have to answer what Burp stops sending to history, but the question doesn't need an answer - simply pressing "completed" is ok
willow glade
Greetings I am doing XSS room and for some reason even if I successed with XSS word blacklisting stil not getting the flag
its weir
d
heavy wyvern
Not sure if it has been reported, but
when you leave a room with a machine on it doesn't terminate itself + that control panel will disappear.
regal flint
Working through Advent of Cyber Day 11 (task 16). First time working with FTP and I keep getting "500 Illegal PORT command" when I try to use ls or dir after successfully logging in as anonymous. When I switch to passive mode and/or binary mode, I get invalid pasv_address. Nothing I could find online or in community help worked for me. I also attempted it using ncftp and filezilla with the same results.
Connected to 10.10.122.31.
220 (vsFTPd 3.0.2)
Name (10.10.122.31:danman5542): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
500 Illegal PORT command.
ftp: bind: Address already in use
ftp> pass
Passive mode on.
ftp> ls
500 OOPS: invalid pasv_address
Passive mode refused.
spiral flame
Known issue, use an EU VPN server for it
crisp kiln
@soft copper hiii
regal flint
@spiral flame You're the best, thanks
jade stratus
@everyone can you help me ???
in the TryHackMe: Common Linux Privesc i answer task 9 number #4 rigth but it said im wrong
i answer at first but it said im wrong the i put the wrong answer in the notepad
but then after i try and fail 20+ time i got curious about the first answer
and i answer that question with that answer again just for fun
but then it said it was the rigth answer
that mean i lost 60 poin for nothing
can you help me with that
light jolt
Windows PrivEsc Arena; Can use TCM credentials to RDP into machine but when using user credentials, you authenticate but cannot RDP into the machine. Tried terminating and re-deploying twice with the same issue. Can someone confirm? I tried using Remmina and Vinagre
winged jackal
This hint doesn't make sense, or I am missing something?
light jolt
i believe its to help beginners, if they dont know where to input the command
median sapphire
@lost wagon That was for a CTF, the CTF ended two-three days ago, THM was sponsoring the CTF.
light jolt
🤷♂️
winged jackal
you have to run other commands in powershell before that
lost wagon
@median sapphire ... ok but why does a 'writeup' go towards the signup page... like even if it was for a ctf it shouldn't be there now
light jolt
it looks like a flag
median sapphire
It redirects to the dashboard, because it's not a writeup, it's a flag.
You'll also find a lot of them in the RP rooms.
lost wagon
again.. if it was for a ctf that ended... it should be gone 😛
median sapphire
But yeah they need to be removed.
topaz venture
When making a new room, this notification instructing you to assign tasks is now redundant because the "Assign" page doesn't exist and you now assign tasks all within managing the room
frosty cape
When making a new room, this notification instructing you to assign tasks is now redundant because the "Assign" page doesn't exist and you now assign tasks all within managing the room
@topaz venture Nice catch, updating that now
covert kernel
so uh i found an bug in profile where you can't link your personal website if its lets say ||https://medium.com/@elfmcskidy||
which means i can't link my medium profile as my personal website
short jackal
remove the @ from the link, site should accept it and it will work
that was mentioned a while back,
@frosty cape mind looking at that?
covert kernel
yes it does accept but then when you click on the link it says the page doesn't exist @short jackal
which technicly means.... it needs to be fixed?
short jackal
frosty cape
Let me fix that now:)
covert kernel
idk sorry if i sound rude or something :/
frosty cape
Fixed, will be made live next week when I next push the latest codebase
covert kernel
okay sounds good 😂
rugged shore
hi every one , i have question about webdav room (https://tryhackme.com/room/bsidesgtdav)
i found a hidden directory i cant bypass basic authentication
i can't find right username
any suggestion for bypass it ? or hint for other methode to complet this challenge
pine quiver
#room-hints #room-help @rugged shore
rugged shore
ah i am sorry
willow glade
Hello there XSS room I am doing filter evansion and the Hello alert appears ,however i havent received any flags, I am trying everything now
Even if i receive flag its not valid
orchid remnant
@covert kernel for now, URL encoding it should work
spiral flame
@jade stratus you didn't lose points. You were wrong, that's all.
runic trench
oof
brittle juniper
Possible ISSUE: If you click on extend button before the box is initialised(Kali RDP), It'll go to that error about disconnecting and going to home page(command center thingy).
covert kernel
Not really a bug, maybe this should be case sensitive (/room/rptmux)
orchid remnant
Oh, we've asked for the ability to control the case sensitivity numerous times..
frosty cape
Another developer coming soon:)
orchid remnant
@frosty cape how difficult would it be as a temporary fix to just turn off the regex for answers less than three characters long?
Ah, already here 😁
And fair enough ♥️
frosty cape
Nah but srsly, Ashu has scheduled a call for next week for the new potential developer
So lots of this smaller functionality can be implemented quicker.
@frosty cape how difficult would it be as a temporary fix to just turn off the regex for answers less than three characters long?
@orchid remnant And very easy
orchid remnant
Ey! Sounds good 👍
covert kernel
carpe diem is 57 days old yet just released? is that because it was made and tested that long ago?
topaz venture
Correct 🙂
It was only tested and approved recently (perhaps about just shy of a week?)
covert kernel
all other released boxes show 1 day
topaz venture
that should reset although O.o
celest bronze
@frosty cape my blood was removed from Carpie Diem?
I put the flags back in, just wanted to let you know.
frosty cape
@frosty cape my blood was removed from Carpie Diem?
I wasn't on the room release today:) Maybe a room tester or the person who released the room reset points? I can look in our audit log to see who did it, but am deep in coding something new:)
Also sorry about (who ever your points got reset)
ornate moss
I did have a problem that when uploading vms it would sit at 0.00%. I saw on my local dns resolver that the domain s3-eu-west-1.amazonaws.com was getting blocked, and whitelisting that fixed the problem.
Just leaving this here if someone else might get the same problem
strong pumice
Banned from joining the new room. I think a few others are/were too.
exotic junco
Windows PrivEsc Arena: A note for all those who cannot log in as a user. Login as TCM. Call Computer Management, select the user under "Local User and Groups -> Users" and switch off the setting "User must change password at next logon".
bitter brook
Sorry new to tryhackme but I have found a bug. Do we submit them here or somewhere else?
orchid remnant
Here is fine 🙂
bitter brook
Found a fault with the "Advent of Cyber" Room. Task 7 - Day 2 where we need to "Scan" the website for folders. Writeups mention finding a /sysadmin folder. But this does not appear when scanning. When attempting to visit the page you get a "Cannot GET /sysadmin" Error.
median sapphire
Task 2, question 23, looking back at this, there is a typo in the hint.
I've personally never heard the phrase 'two or "these" days'. 😄
orchid remnant
Which room @median sapphire?
median sapphire
Sorry, forgot to post the link, here: https://tryhackme.com/room/bpsplunk
orchid remnant
@bitter brook Make sure you're scanning the right room
I, uh, assume that's meant to be "two or three days"
median sapphire
Yep
median sapphire
Thanks 🙂
spiral flame
@frosty cape loads of people can't join carpe
light jolt
Room: Windows PrivEsc Arena -- RDP Login-- Cant RDP into box with given credentials. Admin credentials work fine but the supplied user creds do not
posted this issue before idk if anyone saw
frosty cape
@frosty cape loads of people can't join carpe
@spiral flame Oh really? As in can't join the room or can't access the machine?
frosty cape
I posted a screenshot above
@strong pumice If you're having this issue DM with your username
I'll investigate Monday, at my parents house atm but can do a local fix on my laptop
jade stratus
hello why did my answer were inccorect but i all ready confirmend it was correct but it said it was wrong why???
spiral flame
Because it was wrong
orchid remnant
@jade stratus How did you confirm that it was correct?
orchid remnant
z-indexes broke
(Side note, would someone please get rid of that unread conversation for me? There are no unread conversations -- 0day broke that too)
spiral flame
@orchid remnant I reported the Z thing before
orchid remnant
I thought I'd seen that -- hence not sticking it straight into submissions
Either way, quick reminder Skidy -- CSS broke
ornate ether
The room 'Jack' has a way too easy solution which is most likely not intended.
||As soon as you access the server, you're able to cat /root/root.txt without any privesc||
jade stratus
@jade stratus How did you confirm that it was correct?
@orchid remnant i write the code
covert kernel
I can't reach the supporting materials on a link. I get this instead:
crisp acorn
for the learn linux room task 33 it asks us to create a directory and create a file called test1234 in that directory then run a binary to get the flag
but the files and directory are already there?
fresh tide
Def not a bug but i can access every other page but "My Rooms"
covert kernel
try #site-support ?
median sapphire
@fresh tide Yeah, someone else was also having issues about this yesterday 🤔
ebon lintel
I dont know but i have correctly entered my social information but still can get the option to share after completing a room. Apart from this that option to share automatically cant be accessed afterwards
frosty cape
Def not a bug but i can access every other page but "My Rooms"
@fresh tide Is this fixed now?
orchid remnant
This sounds like the same thing the guy yesterday was talking about. Was a solution found for that?
frosty cape
Yes:)
If they let me know their username I can hotfix it, otherwise they will have to wait until I next push the next THM codebase
fresh tide
Room: sudovulnsbypass
Task2: Typo >> "nothing" instead of "noting"
orchid remnant
Fixed 👍
olive drum
Writeup for https://tryhackme.com/room/rpburpsuite leads to the dashboard
short jackal
that's one of the "writeups" used for the noobctf
fresh tide
^^^ noob{active_crawl_is_legendary!}
median sapphire
@olive drum Yeah, that's a flag for a CTF(thm sponsored), they need to be removed, they are spread out in the site(mostly rp rooms)
short jackal
they were only on RP/BP rooms iirc
olive drum
oh okay
dusk wraith
hey
wintry plank
Room: Introductory Networking
[Task 6] #2 Ping blog.tryhackme.com
PING blog.tryhackme.com (104.26.11.229) - this IP is incorrect 😦
median sapphire
That might be because it was put under Cloudflare
orchid remnant
No -- it was updated
Skidy said that the blog IP would not change
And indeed, it hasn't. Just checking the question now
orchid remnant
Oh, wait
median sapphire
orchid remnant
Blog'll be done through DO same as the main website, I assume
Those just had their IPs manually changed
Either way, question should now be fixed @wintry plank 🙂
median sapphire
@orchid remnant What does DO mean? 🤔
orchid remnant
Digital Ocean
median sapphire
Ah, thanks!
orchid remnant
Np 😁
wintry plank
Thanks a lot 🙂
short jackal
what's up with this user's points? same amount without completing the whole room (no bloods)
the room is androidhacking101
orchid remnant
Do those last questions give points @short jackal?
short jackal
oh wait they don't, somehow didn't notice that
cursive wind
Not a bug I suppose, but in the complete beginner path under Network Security, the overview has the same thing written twice:
umbral stump
